Privacy

When someone visits www.phf.org.uk we use a third party service, Google Analytics, to collect standard internet usage information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. As soon as this information is collected through Google Analytics, users’ IP addresses are made anonymous, and we will not make any attempt to find out the identities of those visiting our website. This data is retained for 26 months, after which time it is automatically deleted.

Our websites are hosted by Krystal Hosting Limited. Apart from the analytical data captured by Google Tag Manager and Google Analytics, the website will also capture all requests made to the server to detect and prevent fraud and unauthorised access and to maintain server security. Krystal Hosting Limited does not store any information other than access and error logs and these details are kept for four weeks by default and then deleted.

We use cookies on our websites in order to make the websites work more efficiently as well as provide information on the use of the site. The cookies collect information in an anonymous form, including the number of visitors to the website and blog, where visitors have come to the website from and the pages they visited. More detail and information on how to change cookies settings is available in PHF’s cookie policy. 

We will only ask for as much information as we need to effectively consider a grant application, to manage an award if you are successful and to monitor its progress. In submitting an application you are agreeing to us processing your data for these purposes and in the ways outlined in this section.

We often collect sensitive personal data for our grant schemes to enable us to monitor the diversity of our applicants and we sometimes use Survey Monkey. This data will be anonymised once it has been matched to the grant award or declination decision and the progress of the application logged. Where we fund individuals, we may also collect sensitive personal data (e.g. passport copies, birth certificates) in order to verify identity. Where this is the case we will destroy the data as soon as identity has been confirmed.

We use Blackbaud Grantmaking to store grant data (including the application module IGAM for application data). More information on Blackbaud Grantmaking Privacy Statement is available in Blackbaud’s privacy statement. 

We use Otter AI to transcribe video calls with applicants and those we fund.

If your application is unsuccessful we will keep a record of your contact details and notes on the assessment process for up to 10 years to enable us to maintain records of your application history should you apply again. 

We may use assessors, advisors, consultants, judges or working group members to assist us with the grant application and management process, including evaluation and research activities. These are often individuals and we will ensure a data processing agreement which meets the standards of GDPR is in place.

We use Diligent Board Packs to support our committee meetings, panels and other forums where decisions are made on applications. Read their privacy statement here.

If your application is successful we will keep your data for the lifetime of the grant plus 10 years to enable us to meet any regulatory and reporting requirements, including HMRC investigations. In addition to application data, we will retain any personal data related to the administration or operation of the grant. After this time we will only retain the name of grant recipients and the amount awarded and some basic details of the grant made for archiving and research purposes.

Information regarding grants awarded is published on the Foundation’s website. We also publish grants data as part of 360 Giving. This will include the title and description of the grant, name of the recipient, date of the award, its duration and the amount awarded. We will not publish address details of individuals who are awarded grants except where these are also the registered addresses of organisations we fund. If you use a personal address for an organisation and do not wish us to publish this information you must inform us as the point of grant award. We may also include information on grants awarded in presentations about the Foundation’s work.

We may invite you to participate in informal networks with other grantees, consultants, staff and those working in your field. To do this we often use Slack, Whats App or Ruzuku who will store your personal data in line with their privacy policy. You can withdraw your permission to participate in Slack/​Ruzuku/​Whats App by following their procedures for closing your account.

We may share personal data about those we have funded with our media monitoring service Meltwater to enable us to collect information on the activity of grantees. 

There may be times we share information with a third party organisation such as a charity or other funder who may contact us for a reference. Most information will be organisational and not personal, but at times personal data (for example the names of senior staff) may be included. This is a legitimate interest as it will improve funding to the sectors we fund.

If you are nominated for application for an award under PHF ​‘Awards for Artists’ scheme we will collect a range of personal data about you for the purposes of considering your application, including some sensitive personal data such as financial information. We may use Open Water or Dropbox to collect this information. This data will be shared with the judges of the scheme who will be contracted to PHF as data processors with an agreement which meets the needs of GDPR. If you are unsuccessful, the majority of this data will be deleted within one year of the date of decision making and then destroyed. We will retain basic details of who was nominated to enable us to monitor nominations over the years. 

If you are successful in being offered an award under our ​‘Awards for Artists’ scheme we will retain personal data to enable us to manage and administer the schemes for the life of the award and up to 10 years subsequently. We will then hold basic details (including name, amount of the award, dates) on an ongoing basis for archive purposes.

To enable us to promote and communicate about the Awards for Artists scheme we will seek the permission of recipients to share personal data about them with media outlets. This will be retained for the life of the award and then retained for archive purposes.

Information regarding grants awarded under the Awards for Artists scheme is published on the Foundation’s website. We also publish grants data as part of 360 Giving. This will include the name of the recipient, date of the award, its duration and the amount awarded. We will not publish address details of individuals who are in receipt of an Award. We may include information on Awards recipients in presentations about the Foundation’s work.

We will invite sector experts to be nominees and/​or judges for the Awards for Artists scheme and will retain their personal contact details to enable us to communicate with them about this using Open Water and internal record keeping systems. Judges who are contracted to participate as part of a decision making panel will be issued with contracts as data processors (see above). 

To enable us to run the Awards for Artists reception we will collect personal data on those invited and attendees. This will be stored in our contacts database Zoho. Read their privacy policy here.

We will retain details of all involved in the Awards for Artists Scheme, whether as applicants, nominees, nominators, judges or recipients to enable us to effectively run the scheme for as long as the scheme is in operation. Individuals can request their removal from our records by email dataprotection@phf.org.uk.

If we use contractors which could include assessors, advisors, consultants, researchers, evaluators, speakers, judges, photographers, videographers or working group members we will hold personal data of these individuals to enable us to contract with them and undertake the tasks for which they are contracted. We may share this data with participants in the task (eg: research participants or grant applicants) if this is necessary for the purposes of the task to be undertaken. 

We will store the contractual information for up to 6 years after the end of the piece of work undertaken to enable us to meet any legal or regulatory requirements. Contact details of assessors, advisors, consultants, judges or working group members will be held for up to 10 years to enable us to keep them informed of work at PHF.

If we have issued an invitation to tender, we will hold details of unsuccessful bidders for up to a year. We will hold data on those who have expressed an interest in working with us in the future for up to 5 years.

We may collect personal data from business contacts to enable us to undertake the legitimate activities of the Foundation. This data will be held for up to 10 years or for as long as the ongoing business relationship is in operation to enable us to contact you if necessary.

rom time to time, the Foundation may undertake research which will involve the collection of personal data. Where possible we will anonymise this data and we will only share it with third parties if we obtain your consent. We may use Survey Monkey, Notion and Nvivo for some of this research. Any identifiable personal data will be held for up to one year following completion of the project.

We regularly commission the Center for Effective Philanthropy to undertake surveys of applicants and those we grant fund and will share with them limited personal data to enable them to contact participants. 

If you contact PHF with an enquiry we will store you details only for as long as necessary to enable us to respond to your enquiry and for up to 3 months after our response. This may be by telephone, email or written correspondence. 

If your enquiry is for pre-application advice and leads to an application, we will hold your details in line with the application and grant management parameters (ie: if declined details will be removed after 10 years; if approved removed lifetime of grant plus 10 years). We use Calendly to manage appointments for pre application advice.

If you attend a PHF event we will hold relevant personal data in order to deliver this event. This may include sensitive personal data about personal circumstances or needs which may be shared with those who deliver aspects of the event e.g. caterers. 

All event attendees may be listed on the delegate list that may be shared with other delegates and event partners such as the venue or transport suppliers. In agreeing to attend the event you are confirming your agreement to us using your details in this way.

Data regarding event attendees may be stored on our Blackbaud Grantmaking grant management system from Blackbaud.

Data is also stored as electronic documents on the PHF servers, accessible by PHF employees.

We will only keep this data for as long as we need to deliver the event and up to 6 months after the event to enable us to complete any follow up administration.

We may well take photographs and record video at events – see details below.

If you visit PHF offices we will ask you to provide your personal details to enable us to keep track of attendees in the building. We will only hold this data for a maximum of one week and not use it for any other purpose. We will however retain details about the numbers of visitors to our offices, for monitoring purposes.

The entrance to our offices is covered by CCTV for the purposes of crime prevention and public safety. Images are held in a secure format and are removed after 30 days.

If we have an obligation to pay you (eg: payment of grants, following delivery of services or to reimburse expenses) we will collect personal data from you to enable us to complete this contractual transaction. We will store this data in our accounting system, Access Financials. You can find the Access Privacy Policy here. We use online banking to make payments and bank details will be entered into Bankline which is supported by National Westminster Bank plc.

Investment fund administrators and other organisations we contract with are required by anti-money laundering (AML) legislation to verify the identity of their clients. Therefore, for AML purposes we are required to keep personal data about our trustees and directors. This data is reviewed every 6 months to ensure only accurate current copies are retained and out of date information is destroyed. However, PHF will retain copies of AML documentation sent to investment funds to verify identify for the lifetime of that investment where the AML documentation forms part of the contractual arrangement with that fund.

PHF will collect personal data of contacts at investment firms and banks as part of our dealings with them. This will be retained for the length of the contract and then deleted.

PHF uses a number of systems to manage its IT infrastructure. Personal data of users (normally only staff) is collected to enable us to manage and operate our systems and is logged in our accounts held on these systems. This includes:

• MD EE – to manage our mobile devices
• Assestrack – to manage our hardware portfolio
• MyHubIntranet – an intranet system
• Microsoft – to provide MS Office facilities
• Egnyte – a remote file server system

In addition, the Foundation contracts with Bluecube IT to provide IT support. Bluecube have access to all PHF systems for the purposes of support and maintenance only and manages PHF’s backup and spam management systems. Their contract includes a data processing agreement which meets the standards of GDPR. 

All of the information you provide during the job application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. We often us Be Applied as a recruitment tool.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us and/​or our data processors whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t. Information on the equal opportunities form will be treated in confidence and will not be seen by staff directly involved in the selection process. The questionnaire will be detached from the application form before the form is seen by those involved in selection, stored separately and used only to provide statistics for monitoring purposes after which point it will be destroyed.

If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 6 months from the closure of the campaign.

Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign.

If you are successful, the information you provide during the application process will be retained by us as part of your employee file. This includes your criminal records declaration, fitness to work, records of any security checks and references. Your employment file will also contain all personal data related to your employment at the Foundation. This will be retained for the duration of your employment plus 6 years following the end of your employment. After that time we will retain basic details of your name, start and end date and job title only for archive purposes. 

Personal contact details of employees will be shared with Foundation managers and trustees for the purposes of emergency contact in line with the Foundation’s Disaster Recovery Plan. Personal contact details of nominated emergency contacts for individual staff members will be held on employee files and will only be used in an emergency. These will be deleted within one month of the employee leaving the Foundation.

We may collect personal details, including special category personal data, for the purposes of diversity monitoring and pay gap reporting and we often use Survey Monkey. Provision of this data is voluntary and staff can choose not to contribute. All data will be stored on PHF’s HR system – People HR and accessible only by the individual, their manager and the administrators of People HR who are based in PHF’s People and Culture team. Reports may be extracted for the purposes of producing calculations – these will be password protected and accessible only the PHF’s People and Culture team. Wider, anonymised reports will be provided to staff and trustees and may be published externally. Staff can update their data on People HR at any time and will be prompted to do this at least annually. Special category personal data will be deleted when an individual’s employment with PHF ends.

Data Processors and HR

We may use recruitment agencies to assist us with filling posts. Details of the Privacy Policies of the agencies will be available on their websites.

PHF uses PeopleHR to record staff information. Find their Privacy Notice here.

PHF contracts payroll management to Crowe. You can find further information here.

PHF offers pension scheme through Prudential – further information here; Group permanent health and life assurance through Aviva - and medical insurance through BUPA – further information further information here.

We use Barbican Financial Advisors to provide advice to staff on pension and insurance matters. 

If you sign up to our newsletter we will retain your personal details to enable us to contact you. We also provide our newsletter to those that we hold legitimate business interests with eg: grantees, staff. You can unsubscribe at any time.

We use a third party provider, MailChimp, to deliver our monthly e‑newsletters. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e‑newsletter. For more information, please see MailChimp’s Privacy Policy

On a yearly basis, we will review the list and ask anyone who has not opened an edition of the newsletter over the past year if they would like to continue their subscription.

PHF uses a variety of social media platforms: X, Facebook, LinkedIn, Instagram, Vimeo, YouTube and SoundCloud. We also use a third party provider Sprout Social to manage and measure our social media interactions on X, Instagram, Facebook and LinkedIn.

If you send us a private message via social media the message will be stored by Sprout Social for three months. It will not be shared with any other organisations.

Videos

PHF will often use videos, which may be commissioned by us or submitted by those we work with, to illustrate the work of the Foundation and the projects we support and these may involve personal data which we collect as part of the legitimate activities of the Foundation. Videos may be stored on PHF systems or hosted on phf.org.uk and or via Vimeo or YouTube  

Videos commissioned by the Foundation may be recorded and edited by external film makers and we will have a data processor agreement which meets the standards of GDPR in place. PHF will keep grantee videos for five years or for the length of the grant plus 2 years, whichever is longer.

From time to time we may showcase videos produced by third parties such as grantees or partners that we work with through our communications channels. In doing so, we will make every effort to ensure suitable permissions and compliance with GDPR are satisfied before use of video. 

Photographs

We may photograph events that PHF host or are involved in and we will inform participants that this is the case either by notice or specific forms. Participants have the right to withdraw their consent by following the instructions given. 

We will also take photographs of staff and trustees – both headshots and at events. Staff and trustees will be asked to provide their consent to the use of these photographs.

We may use the photographs in PHF publications, social media, website or the press. Photographs will be stored on PHF systems and held for up to 5 years, or in the case of staff headshots until the person leaves PHF. If we commission an external photographer we will put a data processor agreement which meets the standards of GDPR in place and the photographer will be bound by the same photograph retention policy.

From time to time we may request images from those we work with to promote the work that we support through our communication channels. In accessing images we will make every effort to ensure suitable permissions and compliance with GDPR are satisfied before use of the images. 

We may collect personal detail about grantees or other individuals involved in the work of the Foundation in order to produce publications about PHF’s work. We will obtain the consent of the individuals involved to their inclusion. The information that we include in PHF publications is shared through our website and other communications channels, including press releases and social media. In the process of preparing and disseminating publications, we may share information with a variety of third party processors. For example, graphic designers will often format and arrange printing of content. Proofreaders and / or consultants may be engaged to review work. In all cases we will ensure a data processor agreement is in place which meets the standards of GDPR. PHF will retain digital and hard copies of publications indefinitely in order to maintain an archive of the Foundation and our grantees’ work.

We may share any data about the operation of PHF with the Foundation’s auditors Crowe, the HMRC, the Charity Commission, the Information Commissioner’s Office, Companies House and other regulatory bodies should this be necessary to complete statutory audit and regulatory requirements.